| Vulnerability Name: | CVE-2017-2480 (CCN-124051) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-12-01 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2017-03-28 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-08-16 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) 5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C)
3.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-200 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-2480 Source: BID Type: Third Party Advisory, VDB Entry 97176 Source: CCN Type: BID-97176 WebKit Memory Corruption and Information Disclosure Vulnerabilities Source: SECTRACK Type: UNKNOWN 1038157 Source: XF Type: UNKNOWN apple-safari-cve20172480-sec-bypass(124051) Source: CCN Type: Packet Storm Security [04-10-2017] WebKit Synchronous Page Load UXSS Source: CCN Type: Apple security document HT207600 About the security content of Safari 10.1 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207599 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207600 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207601 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207607 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207617 Source: EXPLOIT-DB Type: UNKNOWN 41865 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||